Arbitrary Code Injection

Overview neuron-core/neuron-ai is a The PHP Agentic Framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the validation based on the first keyword e.g., SELECT and a forbidden-keyword list does not block file-writing constructs such in the MySQLSelectTool. A...

CVE-2025-10573

Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required...

CVE-2025-13662

CVE-2025-13662 concerns Ivanti Endpoint Manager’s patch management component. The flaw is improper verification of cryptographic signatures, allowing a remote unauthenticated attacker to execute arbitrary code in the context of the target. The impact is high: remote code execution with user inter...

Description of the security update for SharePoint Server 2019: December 9, 2025 (KB5002816)

Description of the security update for SharePoint Server 2019: December 9, 2025 KB5002816 Applies To SharePoint Server 2019 Summary Important If you're currently running SharePoint Workflow Manager, you must install the SharePoint Workflow Manager KB5002799 to your farm before you install this...

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2025-14208

A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub415028 of the file /goform/setwansettings. The manipulation of the argument pppusername results in command injection. It is possible to launch the attack remotely. The exploit has been released to...

KB5071503: Windows Server 2012 R2 Security Update (December 2025)

The remote Windows host is missing security update 5071503. It is, therefore, affected by multiple vulnerabilities - Untrusted pointer dereference in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network. CVE-2025-62549 - Heap-based buffer...

Exploit for CVE-2025-66478

CVE-2025-66478 – Next.js Server Actions RCE Vulnerability: Ana...

PT-2025-49583

Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution RCE...

Android libimagecodec.quram.so Code Execution

The vulnerability of the Android operating system’s libimagecodec.quram.so library in Samsung mobile devices is related to writing beyond the buffer boundaries of memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

RHEL 8 : redis:6 (RHSA-2025:19238)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19238 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182-poc-tool A powerful exploit tool for detecting...

CVE-2025-14191

A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formP2PLimitConfig. Such manipulation of the argument except leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed t...

EUVD-2025-201544

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolveimportdirectory function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday formally added a critical security flaw impacting React Server Components RSC to its Known Exploited Vulnerabilities KEV catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 CVSS...

Exploit for Code Injection in Sabberworm Php_Css_Parser

CVE-2020-13756 Vulnerable Environment Vulnerable test environ...

CVE-2024-58275

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell - CVE-2025-55182 Lab A comprehensive laboratory f...

PT-2025-49315

Name of the Vulnerable Software and Affected Versions Google Apigee versions prior to Hybrid 1.11.2 Google Apigee versions prior to Hybrid 1.12.4 Google Apigee versions prior to Hybrid 1.13.3 Google Apigee versions prior to Hybrid 1.14.1 Google Apigee versions prior to OPDK 5202 Google Apigee...

PT-2026-20856

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in GIMP's parsing of PGM files due to a lack of proper memory initialization before access. This can allow a remote attacker to execute arbitrary code on affected systems. User...